Technology

This is what happens when the source code isnt open to review.

Microsoft has been committing class war against computer users since the 90's and they get all butt hurt as soon as someone holds their code to the flame.

Eclipse implies that Microsoft ignored or refused their zero-day reports and/or did not pay out bounties as requested, somehow causing financial harm in the process.

“Somehow?”

Were the bounties not earned? Because simply not paying as a promised for services rendered is a very clear financial harm.

Responsible disclosure is a kindness; it is not required--especially if/when the vendor doesn't act in good faith.

MS shouldn't be able to silence researchers, but that's what the industry gets by voluntarily clustering around a single, proprietary service.

I don't think either party should be compelled to take (or reverse) any action.

HACK THE PLANET's windows

If she's going for maximum damage, I am surprised this person doesn't just announce when she's found a big exploit, and then just sell it to up to 10 people, and then announce in very vague terms what the exploits are. (Like, "just sold exploit for windows defender" or "just sold way to hack into bitlocker").

It seems like the vagueness of such things would make corporations more worried about being hacked and Microsoft could only guess as to what specific code was hacked, costing them greater resources.

Yes, it would be illegal, and therefore I hope she doesn't do that and recommend against it. But I am just surprised, given the level of anger, that she has been approaching things in a way that is so easy to patch.

Is her approach more damaging the way she's actually doing it?

Best of luck to him on his crusade. Full support!

friendly reminder there is a github replacement for opensource made by framasoft I think

Man, Microsoft just keeps footgunning this one.

Every new exploit, they clearly have a meeting and convince themselves "that's gotta be the last of it, right?"

So the next day-after-patch-tuesday rolls around and lo and behold, this guy drops some more nukes on their reputation as far as their most important customer demographic are concerned (corporate IT)

Given this genuinely does seem to stem from Microsoft mishandling this guy, why the fuck do they keep escalating

If the guy exposing the exploits is the be believed, they notified MS (or attempted to) and were ignored and then actively rebuffed. Then MS deleted the account (and the proof that this person actually reported these vulnerabilities/bugs).

Even if this person is lying I'm more likely to believe MS is the bad guy here. It seems like bullying to me. That and an attempt to mask the problems at the company because they have been getting a lot of bad press and are having trouble with the entirety of windows 11 which they forced on people and they keep breaking. The adoption rate of windows 11 being so bad also lends credence to what this person is claiming.

“Hey, let’s piss off the security expert who’s really good at finding flaws in our products. There’s literally no downside.”

I feel that companies like Microsoft have forgotten that bug bounties and ethical reporting are the compromise where they agree to pay a fair amount for the bugs and are given time to fix them and the security researcher forgoes the 10x price they could get on the black market.

Given the rise in mercenary hacking/spyware corporations, the bug researchers could probably get way more money through those alternate, and still legal, channels.

So I hear.

And this is why if you're going to post something like this, you host your own git. Or use something like codeberg.

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA512

Okay,

So let me get this straight, when I actively asked you to communicate with me, you refused, humiliated me and made sure to insult me in front of people.

You defame me in public with your CVE-2026-45585 advisory even though you literally deleted the Microsoft account I used to report bugs to you with and I got zero pennies from doing so and I still happily did like an idiot.

Now you take the courtesy to flag my github account and wipe it out of the public, just like that ? You are proving to everyone that you actively escalating this conflict but I'm done begging you.

I might sound like crazy idiot who is whinning around but I have proof for every single word I said, I just can't release it yet. Why ? Microsoft still has chains in my hands, it's been like this for years and I just can't stay silent anymore. I hope I can release the documents soon.

Mark this date July 14th, I will make sure your bones are shattered that day. Nothing will be released this June (or maybe I will release smtg, depending on circumstances).

Also,

CVE-2026-45498 is UnDefend

CVE-2026-41091 is RedSun

New GitLab account,

https://gitlab.com/nightmare-eclipse

-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQRJTvAf/AWVhAKEeb7FFoRCS0/SbAUCahGg+gAKCRDFFoRCS0/S

bBMIAPsEczivsL71pbJizJHHlNNOf9guPAFFshJhhkwrDrwZ5wD/Vz6Z+d6vSvhQ

uVrEh4lPM84Q8+J56RLa50Zp46QLkAY=

=8wON

-----END PGP SIGNATURE-----

https://deadeclipse666.blogspot.com/

Their account on GitLab is already blocked https://gitlab.com/nightmare-eclipse

Microsoft has been mum on any details about these matters, so it's hard to tell if the situation is about an uncooperative researcher who doesn't follow standard disclosure rules or a company being difficult about security reports. Regardless, the move to ban Eclipse's GitHub account makes for poor optics, as it is being heavily criticized, and ultimately achieves nothing for security, since the code is out there anyway.

Classic Streisand effect. Just two years ago Satya Nadella publicly announced they're prioritizing security above all else, but now have nothing to say about these exploits and are trying to silence the researcher? Viewing from the sidelines, it did seem a bit reckless how Eclipse was dropping these as zero days, but Microsoft's actions speak louder than words and they probably didn't pay for the bounties.

I wonder if the dude happened to find an internally documented backdoor intended for use by government actors? Or most likely they just don’t wanna deal with it and the perceived fastest way to deal with it is to try and bury it. Both could be true, but I’m just speculating.

I'm surprised admins found a window large enough when github wasn't down to ban the researcher.

Microsoft closed the case after the reporter refused to submit a video of the exploit

They don't have any actual fucking security experts there, so they require video proof that ape will understand.

Posting zero day exploits on github is a shit move. But Microsoft should be happy that this guy posted it on github rather than selling it on the black market.

Banning his guthub account won't make zero day vulnerabilities go away ffs.

Is this the bitlocker backdoor? That's not an exploit / zeroday

Thats making a backdoor be known.

and their gitlab is already blocked as well

The saga has drawn speculation from other experts, like William Dormann from Tharros, who said that "MSRC used to be quite excellent to work with. But to save money, Microsoft fired the skilled people, leaving flowchart followers. I wouldn't be surprised if Microsoft closed the case after the reporter refused to submit a video of the exploit, since that's apparently an MSRC requirement now."

. . . In this day and age, when AI-powered security research has arguably made the standard 90-day disclosure-to-patch window completely obsolete, and both time-until-exploit and unused exploits are both nearing zero, Microsoft and other software players would do well to adjust their policies.

That's such an insane aside. 90-day disclosure-to-patch. Craziness.

On the other hand, this is exactly the way microsoft has been for - easily - 30 years. Like, 1996 microsoft could be slotted into today and literally nothing would change. Other than Nadella would probably be on a bunch of coke.

What even is the headline

Didn't Google also recently used their stupid AI to find exploits in FFMPEG and then blackmailed them to fix it before deadline or they will release them to the public? If banning a dev for such "act" is right, then banning the company should also be right. Ban all of them.

I'm no expert. Is this an issue where MS is refusing to pay bounties to the researcher for finding the bugs, and MS follows up by deleting the researcher's git hub? Am I missing anything? If I understand the basics, this is how you turn a white hat into a black hat. Good job microslop.